The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
swirlai/swirl-search 3 adequate · 2 strong Python 44,759 lines 3,051 2026-11-03 adequate
dtm-labs/dtm 2 adequate · 3 strong Go 21,491 lines 10,923 2026-10-23 strong
tyktechnologies/tyk 3 adequate · 2 strong Go 464,565 lines 10,870 2026-10-23 adequate
crossplane/crossplane 1 adequate · 4 strong Go 177,826 lines 12,189 2026-10-22 strong
skypilot-org/skypilot 2 adequate · 3 strong Python 724,101 lines 10,738 2026-10-23 strong
clj-kondo/clj-kondo 2 adequate · 2 strong Clojure 65,755 lines 1,859 2026-11-07 adequate
django-cms/django-cms 1 adequate · 3 strong Python 132,493 lines 10,679 2026-10-23 strong
kedacore/keda 1 adequate · 4 strong Go 217,273 lines 10,657 2026-10-23 strong
avo-hq/avo 2 adequate · 3 strong Ruby 100,302 lines 1,812 2026-11-08 strong
screego/server 3 adequate · 2 strong Go 6,439 lines 10,738 2026-10-23 adequate
mautic/mautic 2 adequate · 3 strong PHP 701,569 lines 10,830 2026-10-23 strong
root-gg/plik 2 adequate · 3 strong Go 92,728 lines 1,839 2026-11-07 strong
sveltia/sveltia-cms 1 adequate · 3 strong JavaScript 637,043 lines 3,034 2026-11-03 strong
mtrudel/bandit 1 adequate · 2 strong Elixir 26,506 lines 1,932 2026-11-07 adequate
fwdcloudsec/granted 1 adequate · 3 strong Go 16,642 lines 1,810 2026-11-07 strong
obsidiandynamics/kafdrop 2 adequate · 2 strong Java 10,891 lines 6,156 2026-10-28 adequate
sindresorhus/is 1 adequate · 2 strong TypeScript 6,550 lines 1,795 2026-11-08 adequate
towardsthecloud/cloudburn 3 adequate · 2 strong TypeScript 109,998 lines 1,800 2026-11-07 adequate
meshtastic/firmware 4 adequate · 1 strong C++ 333,656 lines 8,344 2026-10-25 adequate
oomol-lab/open-connector 3 adequate · 2 strong TypeScript 1,636,740 lines 6,111 2026-10-28 adequate
ledger/ledger 1 adequate · 2 strong C++ 114,949 lines 6,063 2026-10-28 adequate
javalin/javalin 3 strong Kotlin 41,454 lines 8,355 2026-10-25 adequate
graylog2/graylog2-server 2 adequate · 3 strong Java 1,250,523 lines 8,151 2026-10-25 strong
lf-edge/ekuiper 2 adequate · 3 strong Go 305,770 lines 1,747 2026-11-08 strong
moltis-org/moltis 2 adequate · 2 strong Rust 803,386 lines 2,939 2026-11-03 adequate
polarsource/polar 2 adequate · 3 strong Python 1,144,782 lines 10,411 2026-10-23 strong
dograh-hq/dograh 2 adequate · 3 strong Python 356,854 lines 5,972 2026-10-28 strong
htop-dev/htop 1 adequate · 1 strong C 51,845 lines 8,353 2026-10-25 adequate
voidauth/voidauth 4 adequate · 1 strong TypeScript 33,913 lines 2,904 2026-11-03 adequate
hackmdio/codimd 2 adequate · 3 strong JavaScript 28,978 lines 10,158 2026-10-23 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.